Privacy-safe search relevance feedback

[sajeetharan]

Problem

Users need a way to tell the product when search results are useful or not useful, but storing raw query text, prompts, or profile data creates privacy risks and could leak sensitive context.

Proposed solution

Implement privacy-safe search relevance feedback with useful/not useful signals and bounded reason codes, plus aggregate telemetry. The feedback loop should never store raw query text, prompt text, or profile content.

Acceptance criteria

• Useful/not useful feedback events with bounded reason codes.
• Aggregate telemetry only; no raw query or prompt retention.
• Privacy-safe logging and retention limits.
• Tests for edge cases and invalid feedback payloads.
• Clear handling of low-volume or noisy feedback.

Privacy and trust

The system must avoid storing raw query prompts, personal profile details, and other text that could expose identity or intent. Feedback should be reduced to anonymized, bounded metrics and reason codes.

Dependencies

• Search result ranking and feedback events.
• Telemetry pipeline and retention policies.
• Validation and privacy review.